The Linux kernel TLS subsystem had a flaw in tls_sw_sendmsg_locked() where the plaintext sk_msg ring buffer could become full without setting the full_record flag. This caused the ring buffer pointers to wrap incorrectly, leading to overwriting of live fragments and a mismatch in scatterlist size. When the record was pushed, this caused the scatterwalk to read beyond bounds, resulting in a kernel NULL pointer dereference. The issue can be triggered by an unprivileged user on a loopback TCP socket with the TLS ULP attached. The fix involves setting the full_record flag when the ring becomes full and pushing a full record on entry to the sendmsg loop.

An unprivileged local user can cause a kernel NULL pointer dereference, leading to a denial of service (kernel crash) on systems with the affected Linux kernel TLS implementation. There is no indication of privilege escalation or code execution from the provided data.

A fix has been implemented in the Linux kernel to set the full_record flag correctly and push full records promptly, preventing the ring buffer corruption and subsequent crash. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for current remediation guidance.